Vehicular electronic key system

ABSTRACT

An in-vehicle system executes authentication of a mobile device multiple times from a parking state until an engine is started. The in-vehicle system operates in an alert mode when a vehicle is parked, and transmits an authentication signal including a strength change signal. When the in-vehicle system operates in an alert cancellation mode, the mobile device returns a response signal only when there is a change in the strength of the received authentication signal. When the in-vehicle system succeeds in authentication of the mobile device in an authentication process in the alert mode, the in-vehicle system shifts to the alert cancellation mode. When the in-vehicle system operates in the alert cancellation mode, the mobile device returns the response signal irrespective of whether there is the change in the strength of the received authentication signal.

CROSS REFERENCE TO RELATED APPLICATION

This application is based on Japanese Patent Application No. 2016-093321filed on May 6, 2016, the disclosure of which is incorporated herein byreference.

TECHNICAL FIELD

The present disclosure relates to a vehicular electronic key system thatcarries out authentication of a mobile device by performing a wirelesscommunication between an in-vehicle device mounted on a vehicle and themobile device carried by a user.

BACKGROUND ART

Up to now, a vehicular electronic key system has been known in which anin-vehicle device mounted on a vehicle and a mobile device carried by auser perform an authentication process by a wireless communication, andthe in-vehicle device executes a vehicle control such as vehicle doorlocking and unlocking and engine starting based on a success of theauthentication process. In the vehicular electronic key system of thattype, an arrival range of a radio signal transmitted by the in-vehicledevice is limited to a short distance around the vehicle. This isbecause a situation in which the in-vehicle device carries out thewireless communication with the mobile device is limited to a case inwhich the mobile device is present in the vicinity of the vehicle.

However, the vehicular electronic key system described above causesconcern about a relay attack that a third party with malicious intentindirectly realizes a communication between the mobile device and thein-vehicle device with the use of a repeater, thereby realizingunauthorized authentication of the mobile device by the in-vehicledevice. If the relay attack succeeds, the vehicle control such asunlocking the vehicle door or starting the engine is executed eventhough an authorized user does not intend to execute the vehiclecontrol.

On the other hand, various configurations for preventing such a relayattack have also been proposed. An in-vehicle device of a vehicularelectronic key system disclosed in, for example, Patent Literature 1transmits a radio signal including two types of power levels having ahigh level and a low level, and a mobile device sequentially detects astrength of a received signal (so-called RSSI: received signal strengthindication). The mobile device returns the signal to the in-vehicledevice only when the mobile device detects a change in strength of apredetermined level or higher in the received signal.

The relay attack countermeasure disclosed in Patent Literature 1 is atechnology focused on a fact that a repeater used for the relay attackamplifies a radio wave of a frequency band to be relayed to a certainoutput level and transfers the amplified radio wave. In other words,when the radio wave transmitted from the in-vehicle device is relayed bythe repeater, a level difference of the received signal which is to beoriginally detected is not detected. In other words, according to theconfiguration of Patent Literature 1, the mobile device can restrict aresponse from returning to the signal from the in-vehicle device relayedby the repeater. Naturally, unless the response from the mobile deviceis returned, the authentication is not established (that is, fails).

In general, because the strength of the signal attenuates according to apropagation distance, the RSSI detected by a receiver side is larger asa distance from a signal transmission source is smaller. Therefore, themobile device receives the signal transmitted from the in-vehicle devicewith a larger strength as a distance between the mobile device and anantenna (hereinafter referred to as a vehicle-side transmission antenna)provided for the mobile device to transmit the signal is shorter.

PRIOR ART LITERATURES Patent Literature

Patent Literature 1: JP 2010-185186 A

SUMMARY OF INVENTION

A circuit (hereinafter referred to as RSSI detection circuit) fordetecting the RSSI of the received signal can be realized by awell-known circuit configuration. However, a range of a value that canbe output as the RSSI (hereinafter referred to as “output range”) isusually set for such an RSSI detection circuit.

For that reason, when a signal having a strength higher than a maximumvalue (in other words, an upper limit value) of the output range isreceived, the RSSI of the received signal is output as the upper limitvalue of the output range. For convenience sake, the signal strengthcorresponding to the upper limit value of the output range is referredto as “saturation level” hereinafter.

In the case where the mobile device is disposed in the vicinity of avehicle-side transmission antenna, even if a power level of a signal isset to a low level, the mobile device may receive the signal at thesaturation level. It is needless to say that when the signal transmittedat the low level reaches the mobile device at the saturation level, thesignal transmitted at a high level also reaches the mobile device at thesaturation level. In such a case, since the RSSI of both the signaltransmitted at the high level and the signal transmitted at the lowlevel is the upper limit value, a strength change of the received signalcannot be detected.

In other words, in the configuration of Patent Literature 1, when themobile device is disposed at a position closer to the vehicle-sidetransmission antenna as the signal whose power level is set to the lowerlevel can be received at the saturation level, the strength changecannot be detected in the received signal, resulting in an event thatauthentication fails. It is needless to say that when the authenticationfails, a control that is to be executed at the time of successfulauthentication is not carried out, which may impair the user'sconvenience.

The present disclosure has been made in view of the above circumstance,and it is an object of the present disclosure to provide a vehicularelectronic key system which is capable of restricting a reduction inuser's convenience while restricting the possibility of unauthorizedestablishment of authentication in a wireless communication between anin-vehicle device and a mobile device.

A vehicular electronic key system according to an aspect of the presentdisclosure includes an in-vehicle device that is mounted on a vehicleand a mobile device that is associated with the in-vehicle device andcarried by a user of the vehicle, and the in-vehicle device performs apredetermined control process to the vehicle when an authenticationprocess by a wireless communication between the in-vehicle device andthe mobile device is successful. The in-vehicle device has two operationmodes including an alert mode and an alert cancellation mode. Thein-vehicle device is set to execute the authentication process aplurality of times during a series of operations supposed to be executedby the user when the user boards the vehicle that is parked and starts apower source of the vehicle. The in-vehicle device includes avehicle-side transmission unit that transmits an authentication signalused for authentication of the mobile device from a vehicle-sidetransmission antenna provided in the vehicle, a transmission strengthadjustment unit that adjusts a strength of the authentication signaltransmitted from the vehicle-side transmission antenna, and a modecontrol unit that controls the operation mode of the in-vehicle device.The authentication signal includes operation mode information indicatingthe operation mode of the in-vehicle device. When the in-vehicle deviceoperates in the alert mode, the vehicle-side transmission unit transmitsthe authentication signal including a strength change signal that is asignal whose signal strength is changed with a predetermined pattern.The mode control unit sets the operation mode to the alert mode when thevehicle is parked, and switches the operation mode to the alertcancellation mode if the authentication of the mobile device issuccessful when the in-vehicle device operates in the alert mode. Themobile device includes a mobile device-side reception unit that receivesthe authentication signal through the mobile device-side receptionantenna, a reception strength detection unit that sequentially detects areceived signal strength of the signal received by the mobiledevice-side reception unit, a strength change determination unit thatdetermines whether the strength change with the predetermined patternoccurs in a strength change region that is a portion corresponding tothe strength change signal among the authentication signals whenreceiving the authentication signal indicating that the in-vehicledevice operates in the alert mode, and a mobile device-side transmissionunit that transmits a response signal that is a signal as a response tothe authentication signal. When the mobile device-side reception unitreceives the authentication signal indicating that the in-vehicle deviceoperates in the alert cancellation mode, the mobile device-sidetransmission unit returns the response signal. When the mobiledevice-side reception unit receives the authentication signal indicatingthat the in-vehicle device operates in the alert mode, the mobiledevice-side transmission unit returns the response signal if thestrength change determination unit determines that the strength changeoccurs, and the mobile device-side transmission unit does not return theresponse signal if the strength change determination unit determinesthat no strength change occurs in the strength change region.

In the above configuration, when the in-vehicle device operates in thealert mode, the in-vehicle device transmits the authentication signalincluding the strength change signal as in Patent Literature 1. Then,when the in-vehicle device operates in the alert mode, the mobile devicereturns the response signal to the authentication signal only when thereceived authentication signal contains the strength change. In otherwords, when the in-vehicle device operates in the alert mode, if thestrength change is not detected in the received authentication signal,the in-vehicle device does not return the response signal. Therefore, asin Patent Literature 1, the possibility that the authentication in thewireless communication between the in-vehicle device and the mobiledevice is illegally established can be restricted.

In addition, when the in-vehicle device successfully authenticates themobile device by the authentication process in the alert mode, thein-vehicle device shifts to the alert cancellation mode. When thein-vehicle device operates in the alert cancellation mode, the mobiledevice does not consider whether there is a change in strength in thedetermination of whether to transmit the response signal to the receivedauthentication signal.

Therefore, after the authentication of the mobile device by theauthentication process in the alert mode has succeeded once among theauthentication processes to be executed multiple times in the series ofoperations executed by the user to start the power source, theauthentication process does not fail due to the fact that the change inthe strength cannot be detected in the received signal. The ability toreduce a risk of failure of the authentication process contributes to animprovement in the user's convenience.

In other words, according to the configuration described above, areduction in the user's convenience can be restricted while thepossibility that the authentication in the wireless communicationbetween the in-vehicle device and the mobile device is illegallyestablished is reduced.

BRIEF DESCRIPTION OF DRAWINGS

The above and other objects, features and advantages of the presentdisclosure will become more apparent from the following detaileddescription made with reference to the accompanying drawings. In thedrawings:

FIG. 1 is a block diagram showing a schematic configuration of avehicular electronic key system according to an embodiment of thepresent disclosure;

FIG. 2 is a block diagram showing a schematic configuration of anin-vehicle system;

FIG. 3 is a diagram showing an example of an installation position of avehicle-side transmission antenna;

FIG. 4 is a functional block diagram showing a schematic configurationof a vehicle-side control unit;

FIG. 5 is a chart showing one example of a schematic signal waveform ofan authentication signal;

FIG. 6 is a chart showing another example of the schematic signalwaveform of the authentication signal;

FIG. 7 is a block diagram showing a schematic configuration of a mobiledevice;

FIG. 8 is a functional block diagram showing a schematic configurationof a mobile device-side control unit;

FIG. 9 is a flowchart illustrating a boarding related process to beexecuted by an authentication ECU;

FIG. 10 is a flowchart subsequent to the flowchart shown in FIG. 9;

FIG. 11 is a flowchart illustrating an alert mode authenticationprocess; and

FIG. 12 is a diagram showing a relationship between a signal propagationdistance and an RSSI.

EMBODIMENTS FOR CARRYING OUT INVENTION

Hereinafter, embodiments of the present disclosure will be describedwith reference to the accompanying drawings. FIG. 1 is a diagram showingan example of a schematic configuration of a vehicular electronic keysystem according to the present embodiment. As shown in FIG. 1, thevehicular electronic key system includes an in-vehicle system 100 thatis mounted on a vehicle V and a mobile device 200 that is carried by auser of the vehicle V. The mobile device 200 is associated with thein-vehicle system 100 and has a function as a key unique to the vehicleV.

For the sake of convenience, the vehicle V on which the in-vehiclesystem 100 is mounted will also be described as a subject vehicle in thefollowing description. In the present embodiment, the subject vehicle isassumed to be an engine vehicle including only an engine as a powersource, but is not limited to the engine vehicle. The subject vehiclemay be configured by a so-called hybrid vehicle including an engine anda motor as a power source, or an electric vehicle including only a motoras a power source.

<Outline of Vehicular Electronic Key System>

Each of the in-vehicle system 100 and the mobile device 200 has afunction to realize a well-known remote keyless entry (hereinafterreferred to as RKE) system. More specifically, the mobile device 200includes multiple switches 230 operated by the user, and transmits acommand signal corresponding to the switch 230 operated by the user tothe in-vehicle system 100.

Upon receiving the command signal transmitted from the mobile device200, the in-vehicle system 100 executes a vehicle control according tothe received command signal. For example, the in-vehicle system 100controls a locked state (that is, locking and unlocking) of the vehicledoor based on the command signal transmitted from the mobile device 200.

In addition, each of the in-vehicle system 100 and the mobile device 200has a function to execute a wireless communication with the use of theradio wave of a predetermined frequency band for realizing a well-knownsmart entry system.

More specifically, the in-vehicle system 100 has a function oftransmitting a signal of a predetermined LF (low frequency) band in apredetermined range in a vehicle interior and around the vehicle and afunction of receiving a signal of a predetermined RF (radio frequency)band transmitted from the mobile device 200. The mobile device 200 has afunction of receiving the signal of the LF band transmitted from thein-vehicle system 100 and a function of returning the signal of thepredetermined RF band to the in-vehicle system 100.

Radio waves in a frequency band other than the LF band may be used forsignal transmission from the in-vehicle system 100 to the mobile device200. Similarly, the radio waves in a frequency band other than the RFband may be used for signal transmission from the mobile device 200 tothe in-vehicle system 100. A range in which the LF band signaltransmitted by the in-vehicle system 100 propagates while maintainingthe signal strength receivable by the mobile device 200 is referred toas an LF communication area. The LF communication area may beappropriately designed. As an example, the LF communication area in avehicle exterior falls within a range of several meters from thevehicle.

In the configuration described above, when the mobile device 200 ispresent in the LF communication area, the in-vehicle system 100 executesthe authentication process by a wireless communication with the mobiledevice 200, and executes various controls for performing door lockingand unlocking, engine starting and the like based on the establishmentof authentication. In this example, the authentication process is aprocess in which the in-vehicle system 100 confirms that a communicationterminal (hereinafter referred to as a communication target) thatimplements a wireless communication with the subject in-vehicle system100 is the mobile device 200 (that is, a legitimate mobile device 200)associated with the subject in-vehicle system 100. The fact that theauthentication is established corresponds to determination that thecommunication terminal is the legitimate mobile device 200.

The in-vehicle system 100 authenticates the mobile device 200 by thewireless communication, as a result of which the user carrying themobile device 200 can realize the locking and unlocking the door, thestarting and stopping of the engine, and so on without operating themobile device 200 as a key. The authentication of the mobile device 200by the in-vehicle system 100 may be performed by a well-known challengeresponse method. Details of the authentication process will be describedlater. As a preparation for the authentication process, the mobiledevice 200 and the in-vehicle system 100 each store a common encryptionkey used for the authentication process. In addition, a uniqueidentification number (hereinafter referred to as a mobile device ID) isassigned to the mobile device 200, and the mobile device ID isregistered in the in-vehicle system 100. The mobile device ID may beused as the encryption key described above.

<Configuration of Vehicle System 100>

Next, the configuration of the in-vehicle system 100 will be described.As shown in FIG. 2, the in-vehicle system 100 includes an authenticationECU 110, a vehicle-side transmission antenna 120, a touch sensor 130, astart button 140, a lock button 150, a body ECU 160, and an engine ECU170.

The authentication ECU 110 is electrically connected to the vehicle-sidetransmission antenna 120. In addition, the authentication ECU 110 isconnected to each of the touch sensor 130, the start button 140, thelock button 150, the body ECU 160, and the engine ECU 170 through a LAN(local area network) built in the vehicle in a manually communicablemanner.

The authentication ECU 110 is an ECU (ECU: electronic control unit) thatexecutes various processes for realizing the above-described smart entrysystem and an RKE system (hereinafter referred to as a keyless entrysystem or the like).

The authentication ECU 110 corresponds to an in-vehicle device. In thepresent embodiment, two types of operation modes including an alert modeand an alert cancellation mode are set in the authentication ECU 110.

The alert mode is an operation mode for authenticating the mobile device200 by an authentication method that introduces a mechanism (that is, arelay attack countermeasure) for restricting the authentication fromillegally succeeding by a relay attack. The alert cancellation mode isan operation mode in which the mobile device 200 is authenticatedwithout performing the relay attack countermeasure taken in the alertmode. Details of the operation of the authentication ECU 110 in eachoperation mode and the relay attack countermeasure will be describedlater.

For the mobile device 200, the operation mode of the authentication ECU110 corresponds to the operation mode of the in-vehicle system 100.Therefore, a state that the authentication ECU 110 operates in the alertmode is also referred to as a state that the in-vehicle system 100operates in the alert mode hereinafter. The same is applied to the alertcancellation mode.

The authentication ECU 110 includes a vehicle-side control unit 111, avehicle-side reception antenna 112, a vehicle-side reception unit 113,and a transmission control unit 114 as finer components.

The vehicle-side control unit 111 is configured as a normal computerincluding a CPU 1111, a RAM 1112, a ROM 1113, an I/O 1114, and a busline that connects those components to each other. The ROM 1113 stores aprogram (hereinafter referred to as a vehicle program) for causing thenormal computer to function as the vehicle-side control unit 111, andthe like.

The vehicle program described above may be stored in a non-transitorytangible storage medium, and a specific storage medium is not limited toa ROM. Execution of the vehicle program by the CPU 1111 corresponds toexecution of a method corresponding to the vehicle program. Thevehicle-side control unit 111 realizes a smart entry system or the likeby causing the CPU 1111 to execute the vehicle program. Details of thevehicle-side control unit 111 will be described later.

The vehicle-side reception antenna 112 is an antenna for receiving theradio wave in the RF band. The vehicle-side reception antenna 112converts the received radio wave into an electric signal and providesthe converted electric signal to the vehicle-side reception unit 113.The vehicle-side reception unit 113 subjects the signal input from thevehicle-side reception antenna 112 to predetermined processing such asanalog-to-digital conversion, demodulation, and decoding to extract dataincluded in the received signal. Then, the vehicle-side reception unit113 provides the extracted data to the vehicle-side control unit 111.

The transmission control unit 114 subjects the data input from thevehicle-side control unit 111 to predetermined processing such asencoding, modulation, and digital-to-analog conversion and converts theinput data into a carrier signal. Then, the transmission control unit114 outputs the carrier signal to the vehicle-side transmission antenna120 and radiates the output carrier signal as the radio wave.

In addition, the transmission control unit 114 includes a poweradjustment unit 1141 that adjusts a transmission power of the carriersignal (in other words, the strength of the transmission signal) as amore detailed function. With the power adjustment unit 1141, thetransmission control unit 114 can change the transmission power of thesignal to be transmitted to the mobile device 200 to an arbitrary leveland transmit the transmission power. At least the power adjustment unit1141 according to the present embodiment may be configured to be able toadjust the output level in two stages of a default level and asuppression level.

The default power is the transmission power to be employed at the timeof normal signal transmission. The normal transmission time correspondsto a case of transmitting a signal including information, specifically,a case of transmitting an information signal Sa to be described later,or the like. The default power may be designed appropriately. Thesuppression level may be appropriately designed to a value having asignificant difference from the default power in a range smaller thanthe default power. For example, the suppression level may be half of thedefault level.

The power adjustment unit 1141 may be realized with the use of a knownattenuator that attenuates a signal or a variable gain amplifier thatcan adjust the amplification degree. For example, the power adjustmentunit 1141 may be configured to adjust the transmission power byconnecting or disconnecting the attenuator to or from a signalpropagation system with the use of a switch.

The transmission control unit 114 operates in a different mode accordingto the operation mode of the authentication ECU 110 in theauthentication process.

Details of the operation of the transmission control unit 114 at thetime of the authentication process will be described later. Thetransmission control unit 114 corresponds to a vehicle-side transmissionunit, and the power adjustment unit 1141 corresponds to a transmissionstrength adjustment unit.

The vehicle-side transmission antenna 120 is an antenna for convertingthe carrier signal input from the authentication ECU 110 (morespecifically, the transmission control unit 114) into the radio wave inthe LF band and radiating the radio wave to a space. The multiplevehicle-side transmission antennas 120 are provided in multiplelocations appropriately designed so that a predetermined range in thevehicle exterior of the vehicle V and an entire area in the vehicleinterior are included in the LF communication area.

In the present embodiment, as an example, the vehicle V is provided withone vehicle interior antenna 120A and multiple vehicle exterior antennas120B as the vehicle-side transmission antenna 120 as shown in FIG. 3. Itshould be noted that the transmission area of a certain vehicle-sidetransmission antenna 120 to be described later is an area at which thesignal transmitted from the vehicle-side transmission antenna 120arrives while keeping the signal strength receivable (in other words,decodable) by the mobile device 200. A collection of the transmissionareas of the respective vehicle-side transmission antennas 120corresponds to an LF communication area for the vehicle V.

The vehicle interior antenna 120A is a vehicle-side transmission antenna120 disposed in the vehicle interior so that the vehicle interior is setas the transmission area. The vehicle interior antenna 120A is installedso as to include at least a periphery of a driver's seat in thetransmission area. For example, the vehicle interior antenna 120A may beprovided in a center of an instrument panel in a vehicle width directionor in the vicinity of a center console box. In another mode, multiplevehicle interior antennas 120A may be provided.

The vehicle exterior antennas 120B are vehicle-side transmissionantennas 120 installed so as to include a predetermined range in thevehicle exterior in the transmission area. For example, the vehicleexterior antennas 120B may be provided in the vicinity of handles of therespective doors provided in the vehicle V (including the inside of thehandles).

It is needless to say that the installation position and thetransmission area of the vehicle-side transmission antenna 120 mountedon the vehicle V are not limited to the embodiment described above. Inaddition to the above configuration, the vehicle V may be provided withthe vehicle-side transmission antenna 120 having the transmission areain a trunk. The installation position and installation number, and so onof the vehicle-side transmission antenna 120 may be appropriatelydesigned so as to provide a desired transmission area.

The touch sensor 130 is installed in each door handle of the vehicle anddetects that the user touches the door handle. The detection results ofthe respective touch sensors 130 are sequentially output to theauthentication ECU 110.

The start button 140 is a push switch for the user to start the engine.When a push operation is performed by the user, the start button 140outputs a control signal indicating that the start button 140 is pushedto the vehicle-side control unit 111.

The lock button 150 is a button for the user to lock the door of thevehicle. The lock button 150 may be provided on each door handle of thevehicle V. When the user presses the lock button 150, the lock button150 outputs a control signal indicating that the lock button 150 ispushed to the authentication ECU 110.

The body ECU 160 is an ECU that controls various actuators mounted onthe vehicle. For example, the body ECU 160 outputs a drive signal forcontrolling the locking and unlocking of the door provided in thevehicle to a door locking motor provided in each vehicle door based onan instruction from the authentication ECU 110, and locks and unlockseach door. Further, the body ECU 160 acquires information indicating theopening or closing state of each door provided in the vehicle, thelocked or unlocked state of each door, or the like. The opening orclosing state of the door may be detected by a courtesy switch.

The engine ECU 170 is an ECU that controls the operation of the engine.For example, when the engine ECU 170 acquires a start instruction signalinstructing starting of the engine from the authentication ECU 110, theengine ECU 170 starts the engine.

<Function of Vehicle-Side Control Unit 111>

As shown in FIG. 4, the vehicle-side control unit 111 includes a vehicleinformation acquisition unit F1, a vehicle state determination unit F2,a mode control unit F3, an authentication processing unit F4, and an RKEprocessing unit F5 as functional blocks realized by execution of theabove-described vehicle program by the CPU. Meanwhile, some or all ofthe functions of the vehicle-side control unit 111 may be realized byhardware with the use of one or multiple ICs or the like.

The vehicle information acquisition unit F1 acquires various information(that is, vehicle information) indicating a state of the vehicle fromsensors and ECUs mounted on the vehicle such as the touch sensor 130.The vehicle information is indicative of, for example, whether the usertouches the door handle, an opening or closing state of the door,whether the brake pedal is stepped on, whether the start button 140 ispushed down, a locked or unlocked state of each door, and so on.

Whether the user touches the door handle can be acquired from the touchsensor 130 and whether the start button 140 is pushed down can bedetermined according to a signal output from the start button 140. Theopening or closing state of the door, the locked or unlocked state ofeach door, and the like can be acquired from the body ECU 160, forexample. The opening or closing state of the door may be detected by acourtesy switch. Whether the brake pedal is stepped on can be detectedby a brake pedal sensor that detects a stepped amount of the brake pedalby the user.

The information included in the vehicle information is not limited tothe information described above. A shift position detected by a shiftposition sensor not shown, an operation state of a parking brake, and soon are also included in the vehicle information.

The vehicle state determination unit F2 determines a condition of thevehicle V based on the vehicle information acquired by the vehicleinformation acquisition unit F1. The vehicle state determination unit F2includes a parking determination unit F21 and an event detection unitF22 as finer functional blocks.

The parking determination unit F21 determines whether the vehicle V isparked based on the vehicle information acquired by the vehicleinformation acquisition unit F1. For example, the parking determinationunit F21 determines that the vehicle is parked when the engine is offand all the doors are closed and locked. It is needless to say that awell-known algorithm can be employed as a determination algorithm fordetermining whether the vehicle is parked. For the sake of convenience,a state in which the vehicle is parked is described as a parking state,and a state in which the vehicle is not parked is described as anon-parking state.

The event detection unit F22 detects that the vehicle V has transitionedfrom the non-parking state to the parking state or that a predetermineduser's operation has been performed on the vehicle V as anauthentication execution event. The authentication execution event is anevent registered in advance as an event to execute the authenticationprocess.

As an example, the event detection unit F22 detects that the door hasbeen opened, that the door has been closed, that the brake pedal hasbeen stepped on, that the start button 140 has been pushed down, thatthe operation of locking the door of the vehicle (hereinafter referredto as locking operation) has been executed by the user, that the vehicleV has been parked, and the like.

In another configuration, the event detection unit F22 may detect thatthe parking brake has been released, that a seat belt for the driver'sseat has been attached, and that the user is seated in the driver's seatas an authentication execution event. In other words, the authenticationECU 110 may be configured to transmit the authentication signal when theparking brake has been released, when the seat belt for the driver'sseat has been attached, and when it is detected that the user has beenseated in the driver's seat.

The mode control unit F3 is a functional block that controls theoperation mode of the authentication ECU 110. The authentication ECU 110switches the operation mode of the authentication ECU 110 based on thedetection result of the event detection unit F22 and the result of theauthentication process by the authentication processing unit F4 to bedescribed later.

More specifically, when the event detection unit F22 detects that thevehicle V has shifted from the non-parking state to the parking state,the mode control unit F3 sets the operation mode to the alert mode. As aresult, when the vehicle V is parked, the authentication ECU 110operates in the alert mode.

In addition, the mode control unit F3 according to the presentembodiment also sets the operation mode to the alert mode even when allthe doors of the vehicle V have been locked. Locking of all the doorsmay be realized as a function of a smart entry system resulting frompush down of the lock button 150 or may be locked by the RKE system. Inaddition, the doors may be locked with the use of a mechanical key. Inany case, the locking of all the doors means a locking operation for theuser to separate from the vehicle.

As another mode, the mode control unit F3 does not have to shift to thealert mode just because all the doors of the vehicle V have been locked.For example, according to the well-known method, when it is detectedthat the mobile device 200 is in the vehicle exterior and all the doorshave been locked, the mode may be shifted to the alert mode.

Furthermore, when it is determined that the authentication is successfulin the authentication process executed when the operation mode is thealert mode, the mode control unit F3 switches the operation mode to thealert cancellation mode. Once the operation mode is switched to thealert cancellation mode, the operation mode is maintained until thevehicle V is parked.

The authentication processing unit F4 cooperates with the transmissioncontrol unit 114 and performs the authentication process by the wirelesscommunication with the mobile device 200. The conditions under which theauthentication processing unit F4 performs the authentication processmay be appropriately designed.

For example, when the vehicle V is parked, the authentication processingunit F4 transmits a polling signal from the vehicle-side transmissionantenna 120 in a predetermined cycle (for example, 200 milliseconds) incooperation with the transmission control unit 114. The polling signalis a signal that requests the mobile device 200 to respond. By receivinga response signal to the polling signal, the authentication processingunit F4 can detect that the communication terminal possibly being themobile device 200 is present in the wireless communication area.

When receiving the response signal to the polling signal, theauthentication processing unit F4 causes the transmission control unit114 to transmit a signal (that is, an authentication signal) forauthenticating the mobile device 200. The authentication signal includesoperation mode information indicating the operation mode of theauthentication ECU 110 and a challenge code.

The challenge code is a code for authenticating the mobile device 200.The challenge code may be a random number generated with the use of arandom number table or the like. When the mobile device 200 receives thechallenge code, the mobile device 200 encrypts the challenge code with apreviously registered encryption key and returns a signal (hereinafterreferred to as a response signal) including the encrypted code(hereinafter referred to as a response code). In other words, theauthentication signal functions as a signal requesting the mobile device200 to return the response signal. The response signal corresponds to aresponse signal.

In addition, the authentication processing unit F4 transmits theauthentication signal and generates a code (hereinafter referred to as averification code) obtained by encrypting the challenge code with theuse of the encryption key held by the authentication processing unit F4per se. When the returned response code matches the verification code,the authentication processing unit F4 determines that a communicationpartner is a legitimate mobile device 200 (that is, the authenticationis determined to be successful).

In the present embodiment, as an example, the authentication signal istransmitted when the response signal to the polling signal is received,but the present disclosure is not limited to the above configuration.The authentication signal may be periodically transmitted as the pollingsignal. In other words, with the inclusion of the challenge code in thepolling signal, the polling signal may function as the authenticationsignal. The processes from the transmission of the authentication signalto the verification of the code correspond to an authentication process.

It is needless to say that a timing at which the authenticationprocessing unit F4 executes the authentication process is not limited tothe case in which the vehicle V is parked. In addition to the time whenthe response to the polling signal is received, as an example, theauthentication process is executed at the respective timings when thedoor for the driver's seat is opened, when the door for the driver'sseat is closed, when the brake pedal is stepped on, when the startbutton 140 is pushed down, and when the locking operation is executed.The occurrence of the events listed above can be detected by the eventdetection unit F22.

The contents of the control process performed by the authenticationprocessing unit F4 when the authentication process is successful arecontents corresponding to a scene when the authentication process issuccessful (in other words, the condition of the vehicle V). Forexample, when the authentication is successful in the parked state, theauthentication processing unit F4 brings the door into an unlockingready state. The unlocking ready state is a state in which the user canunlock the door by merely touching the touch sensor 130 of the door.Then, when a signal indicating that the user touches the touch sensor130 is input from the touch sensor 130, the authentication processingunit F4 unlocks the key of the door in cooperation with the body ECU160.

Further, in the case where the authentication process executed with thepress of the start button 140 as a trigger is successful, theauthentication processing unit F4 instructs the engine ECU 170 to startthe engine. In the case where the authentication process executed withthe execution of the locking operation as a trigger is successful, theauthentication processing unit F4 may lock all the doors of the vehicle.

The RKE processing unit F5 implements processing on the vehicle-side forrealizing the RKE system described above. Specifically, the RKEprocessing unit F5 analyzes the contents of the command signaltransmitted from the mobile device 200, and executes a vehicle controlcorresponding to the command signal in cooperation with the body ECU 160or the like. The vehicle control corresponding to the command signalincludes, for example, door locking and unlocking, illuminationlighting, startup of an air conditioning system mounted on the vehicle,and the like.

<Details of Operation of Transmission Control Unit 114 at AuthenticationProcess>

Now, the operation of the transmission control unit 114 at theauthentication process will be described in more detail. Thetransmission control unit 114 generates the authentication signal havinga different signal pattern according to the operation mode of theauthentication ECU 110 and causes the generated authentication signal tobe transmitted from the vehicle-side transmission antenna 120.

Specifically, as shown in FIG. 5, when the authentication ECU 110operates in the alert mode, the transmission control unit 114 generatesand transmits an authentication signal including an information signalSa including the operation mode information and a challenge code and astrength change signal Sb whose signal strength is changed in themiddle. In the chart shown in FIG. 5, an axis of abscissa represents atime and an axis of ordinate represents a signal strength (in otherwords, transmission power).

A signal length Tb of the strength change signal Sb, a time point atwhich the signal strength is changed in the subject signal, and thepattern for changing the strength are fixed. In other words, the signalpattern (in other words, a signal waveform) of the strength changesignal Sb is kept constant.

As an example, the transmission control unit 114 operates the poweradjustment unit 1141 such that the signal pattern of the strength changesignal becomes initially in a default level P0 where the strength isrelatively high, and becomes in a suppression level P1 where thestrength is relatively low in the middle. As a result, the signalstrength of the strength change signal changes stepwise from P0 to P1.

An interval Tx from an end of the information signal Sa to a start ofthe strength change signal Sb is also fixed. The position of thestrength change signal Sb in the authentication signal is kept constantas described above, as a result of which when the mobile device 200receives the authentication signal from the authentication ECU 110operating in the alert mode, the mobile device 200 can identify a signalportion of the received signal corresponding to the strength changesignal.

On the other hand, when the authentication ECU 110 operates in the alertcancellation mode, the transmission control unit 114 generates andtransmits the authentication signal not including the strength changesignal Sb as shown in FIG. 6. In other words, the authentication signaltransmitted when the authentication ECU 110 operates in the alertcancellation mode is only the information signal Sa.

Hereinafter, for the sake of convenience, the authentication signalincluding the strength change signal Sb, which is transmitted when theauthentication ECU 110 operates in the alert mode, will also be referredto as a change addition signal. Also, the authentication signal notincluding the strength change signal Sb, which is transmitted when theauthentication ECU 110 operates in the alert cancellation mode, willalso be referred to as a non-addition signal. However, if the changeaddition signal and the non-addition signal are not particularlydistinguished from each other, those signals will be referred to asauthentication signals.

In addition, the authentication process using the change addition signal(in other words, the authentication process in the alert mode) will bereferred to as an alert mode authentication process, and theauthentication process using the non-additional signal (in other words,the authentication process in the alert cancellation mode) will bereferred to as a cancellation mode authentication process.

<Configuration and Operation of Mobile Device 200>

Next, the configuration of the mobile device 200 will be described. Asshown in FIG. 7, the mobile device 200 includes a mobile device-sidereception antenna 210, a mobile device-side reception unit 220, a switch230, a mobile device-side control unit 240, a mobile device-sidetransmission unit 250, and a mobile device-side transmission antenna260. The mobile device-side control unit 240, the mobile device-sidereception unit 220, the switch 230, and the mobile device-sidetransmission unit 250 are communicably connected to each other.

The mobile device-side reception antenna 210 is an antenna for receivingthe radio wave in the LF band. The mobile device-side reception antenna210 is connected to the mobile device-side reception unit 220, convertsthe received radio wave into an electric signal, and outputs theconverted electric signal to the mobile device-side reception unit 220.

The mobile device-side reception unit 220 subjects the signal input fromthe mobile device-side reception antenna 210 to predetermined processingsuch as analog-to-digital conversion, demodulation, and decoding toextract data included in the received signal. Then, the mobiledevice-side reception unit 220 provides the extracted data to the mobiledevice-side control unit 240.

In addition, the mobile device-side reception unit 220 includes an RSSIdetection circuit 221 that sequentially detects a received signalstrength (RSSI: received signal strength indication) which is thestrength of a signal received by the mobile device-side receptionantenna 210. The RSSI detection circuit 221 may be realized by awell-known circuit configuration. The RSSI detected by the RSSIdetection circuit 221 is provided to the mobile device-side control unit240. An output range of the RSSI detection circuit 221 may beappropriately designed. For convenience sake, the signal strengthcorresponding to the upper limit value of the output range is referredto as “saturation level”. The RSSI detection circuit 221 corresponds toa reception strength detection unit.

The switch 230 is a switch for the user to use the function implementedas the RKE system. The mobile device 200 includes, for example, as theswitch 230, a switch 230 for locking all the doors, and a switch 230 forunlocking all the doors. When various switches 230 are pushed by theuser, the switches 230 output a control signal indicating that theswitch 230 is pushed to the mobile device-side control unit 240.

In response to the control signal input from the switch 230, the mobiledevice-side control unit 240 detects that the user's operation forcontrolling the locked state such as the locking and unlocking of thevarious doors provided in the vehicle has been executed, and canidentify the instruction contents. In FIG. 7, for convenience sake, onlytwo switches 230 are illustrated, but the number of switches 230 is notlimited to two. For example, the switch 230 for instructing to unlockonly a trunk door may be provided.

The mobile device-side control unit 240 mainly includes a computerincluding a CPU, a RAM, a ROM, an I/O, and so on not shown. The ROMstores a program (hereinafter referred to as a mobile device program)for causing an ordinary computer to function as the mobile device-sidecontrol unit 240. The mobile device-side control unit 240 realizes asmart entry system or the like by executing the mobile device programstored in the ROM by the CPU. In addition to the above program, anencryption key and the like used for generating a response code in theauthentication process are stored in the ROM. Detailed functions of themobile device-side control unit 240 will be described later.

The mobile device-side transmission unit 250 subjects a baseband signalinput from the mobile device-side control unit 240 to predeterminedprocessing such as encoding, modulation, and digital-to-analogconversion and converts the baseband signal into a carrier signal. Then,the mobile device-side transmission unit 250 outputs the generatedcarrier signal to the mobile device-side transmission antenna 260. Themobile device-side transmission antenna 260 converts a signal input fromthe mobile device-side transmission unit 250 into the radio wave in theRF band and radiates the radio wave to a space.

<Function of Mobile Device-Side Control Unit 240>

As shown in FIG. 8, the mobile device-side control unit 240 includes, asfunctional blocks realized by executing the mobile device programdescribed above, a reception data acquisition unit G1, an RSSIacquisition unit G2, an operation mode determination unit G3, a strengthchange determination unit G4, and a transmission signal generation unitG5. Incidentally, a part or all of the functional blocks included in themobile device-side control unit 240 may be realized as hardware usingone or more ICs or the like.

The reception data acquisition unit G1 acquires the data received by themobile device-side reception unit 220. More specifically, if the mobiledevice-side reception unit 220 receives the authentication signal, thereception data acquisition unit G1 acquires the data obtained bydemodulating the information signal Sa included in the receivedauthentication signal.

The RSSI acquisition unit G2 acquires the RSSI detected by the RSSIdetection circuit 221. The acquired RSSI is stored in a RAM in timeseries order with time stamp indicating an acquisition time. Forconvenience sake, the RSSI stored in the RAM is referred to as RSSIdata.

The operation mode determination unit G3 determines the operation modeof the in-vehicle system 100 based on the operation mode informationincluded in the authentication signal (more specifically, theinformation signal Sa). In other words, the operation mode determinationunit G3 determines whether the received authentication signal is anauthentication signal indicating that the in-vehicle system 100 operatesin the alert mode or an authentication signal indicating that thein-vehicle system 100 operates in the alert cancellation mode.

When receiving the authentication signal indicating that the in-vehiclesystem 100 operates in the alert mode by the operation modedetermination unit G3, the strength change determination unit G4determines whether a strength change equal to or higher than apredetermined detection threshold occurs in a portion corresponding tothe strength change signal Sb of the received authentication signal(hereinafter referred to as an strength change region). The detectionthreshold introduced in this example may be appropriately designed to avalue corresponding to an initial strength change amount ΔPtx, which isa difference between the default level and the suppression level. Forexample, the detection threshold may be set to a value corresponding to¼ of the initial strength change amount ΔPtx.

As described above, the strength change region in the authenticationsignal can be identified from the configuration of the signal pattern.Further, a transition of the RSSI in the strength change region can beidentified by referring to the RSSI data stored in the RAM. Thedetermination result of the strength change determination unit G4 isprovided to the transmission signal generation unit G5.

The transmission signal generation unit G5 generates a signal to betransmitted to the in-vehicle system 100, and outputs the generatedsignal to the mobile device-side transmission unit 250. As describedabove, the signal output to the mobile device-side transmission unit 250is subjected to predetermined signal processing and transmitted from themobile device-side transmission antenna 260.

For example, when the mobile device-side reception unit 220 receives theauthentication signal indicating that the in-vehicle system 100 operatesin the alert cancellation mode, the transmission signal generation unitG5 generates a response code corresponds to the challenge code includedin the subject signal. Then, the transmission signal generation unit G5outputs a response signal including the response code to the mobiledevice-side transmission unit 250.

When the transmission signal generation unit G5 receives theauthentication signal indicating that the in-vehicle system 100 operatesin the alert mode, the transmission signal generation unit G5 determineswhether the response signal is returned according to whether thestrength change that is equal to or higher than a predetermineddetection threshold occurs in the strength change region. Morespecifically, when the in-vehicle system 100 receives the authenticationsignal indicating that the in-vehicle system 100 operates in the alertmode, further when the strength change determination unit G4 determinesthat the strength change occurs in the strength change region, thetransmission signal generation unit G5 generates the response signal,and outputs the generated response signal to the mobile device-sidetransmission unit 250.

On the other hand, in the case of receiving the authentication signalindicating that the in-vehicle system 100 operates in the alert mode,when the strength change determination unit G4 detects no strengthchange in the strength change region, no response signal is generated.According to the configuration described above, the same advantages asthose of Patent Literature 1 are obtained. In other words, unauthorizedauthentication success due to relay attack can be restricted.

In addition, when the mobile device-side reception unit 220 receives thepolling signal, the transmission signal generation unit G5 generates apredetermined signal to be transmitted as a response to the pollingsignal, and outputs the generated signal to the mobile device-sidetransmission unit 250. When the control signal indicating that the userpresses the switch 230 is input from a certain switch 230, thetransmission signal generation unit G5 generates a command signalinstructing to execute the vehicle control corresponding to the switch230 that outputs the control signal. For example, when the switches 230for unlocking all the doors are pushed, the transmission signalgeneration unit G5 generates the command signal instructing to open allthe doors and outputs the generated command signal to the mobiledevice-side transmission unit 250.

<Boarding Related Process>

Next, processing (hereinafter referred to as boarding related process)to be executed by the authentication ECU 110 corresponding to a seriesof operations by the user to board the vehicle V in the parking state tostart the engine will be described with reference to flowcharts shown inFIGS. 9 and 10. The flowchart shown in FIG. 9 may be started when aresponse signal to the polling signal is received. Since the vehicle Vis in the parking state, the operation mode of the authentication ECU110 at the time of starting the present flow is set to the alert mode.

First, in Step S10, the authentication processing unit F4 executes thealert mode authentication process and proceeds to Step S20. Theflowchart shown in FIG. 11 shows an example of a specific processingprocedure for the alert mode authentication process. For the sake ofconvenience, before description of Step S20 and the following steps inFIG. 9, the alert mode authentication process will be described withreference to FIG. 11.

First, in Step S11, the authentication processing unit F4 transmits thechange addition signal from the vehicle-side transmission antenna 120(specifically, the vehicle exterior antennas 120B) in cooperation withthe transmission control unit 114 and proceeds to Step S12. In Step S12,the authentication processing unit F4 determines whether the responsesignal has been received. If the response signal is received until apredetermined response waiting time (for example, 20 milliseconds)elapses after the change addition signal has been transmitted, anaffirmative determination is made in Step S12 and the flow proceeds toStep S13. On the other hand, if the response signal has not beenreceived even after the response waiting time has elapsed since thechange addition signal has been transmitted, a negative determination ismade in Step S12 and the process proceeds to Step S17.

In Step S13, the authentication processing unit F4 checks the responsecode included in the received response signal against the verificationcode generated by the authentication processing unit F4 per se. As aresult of the checking in Step S13, if the two codes match each other,the affirmative determination is made in Step S14, and the processproceeds to Step S15. On the other hand, if the two codes do not matcheach other, the negative determination is made in Step S14, and theprocess proceeds to Step S17.

In Step S15, the authentication processing unit F4 determines that theauthentication has succeeded and proceeds to Step S16. In Step S16, themode control unit F3 sets the operation mode to the alert cancellationmode, and returns to a caller of the present flow.

In Step S17, the authentication processing unit F4 determines thatauthentication has failed and proceeds to Step S18. In Step S18, themode control unit F3 keeps the operation mode in the alert mode andreturns to the caller of the present flow. In other words, when theauthentication in the alert mode authentication process fails, the alertmode is maintained.

Returning to FIG. 9 again, processing following Step S10 will bedescribed. In Step S20, the authentication processing unit F4 registersthe result of the alert mode authentication process in Step S10 in theRAM 1112 and proceeds to Step S30. In Step S30, the event detection unitF22 determines whether the door for the driver's seat has been openedbased on the vehicle information (for example, the output of thecourtesy switch) acquired by the vehicle information acquisition unitF1.

If it is detected that the driver's seat door has been opened, theaffirmative determination is made in Step S30 and the process goes toStep S40. Until the driver's seat door is opened, the negativedetermination is made in Step S30, and the determination process in StepS30 is executed at a predetermined time interval (for example, 100milliseconds). If the door has not been opened even after a lapse of afixed time (for example, 3 minutes) since shifting to Step S30, thepresent flow may be ended.

By the way, even if the authentication in Step S10 fails and the key ofthe door is not in the unlocking ready state, the user can unlock thedoor key by leveraging the RKE function or the like. For that reason,even if the authentication process in Step S10 fails, the user can openthe door by executing a predetermined operation.

In Step S40, the authentication processing unit F4 determines whetherthe current operation mode is the alert mode. If the operation mode isthe alert mode, the affirmative determination is made in Step S40 andthe process proceeds to Step S50. On the other hand, if the operationmode is the alert cancellation mode, the negative determination is madein Step S40 and the process proceeds to Step S60.

In Step S50, the authentication processing unit F4 executes the samealert mode authentication process as that in Step S10 and proceeds toStep S70. In Step S60, the authentication processing unit F4 executesthe cancellation mode authentication process and proceeds to Step S70. Adifference between the cancellation mode authentication process and thealert mode authentication process resides in only the type of theauthentication signal to be transmitted. In other words, the process ofreplacing the signal transmitted in Step S11 of FIG. 11 with thenon-addition signal corresponds to a cancellation mode authenticationprocess. For that reason, a detailed description of the processingprocedure of the cancellation mode authentication process will beomitted.

In Step S70, the authentication result in Step S50 or S60 is registeredin the RAM 1112, and the process proceeds to Step S80. In Step S80, theevent detection unit F22 determines whether the driver's seat door hasbeen closed based on the vehicle information (for example, the output ofthe courtesy switch) acquired by the vehicle information acquisitionunit F1.

If it is detected that the driver's seat door has been closed, theaffirmative determination is made in Step S80 and the process goes toStep S90. Until the driver's seat door is closed, the negativedetermination is made in Step S80, and the determination process in StepS80 is executed at a predetermined time interval (for example, 100milliseconds). If the door has not been closed even after a lapse of afixed time (for example, 5 minutes) since shifting to Step S80, thepresent flow may be ended. Since the processing flow from Steps S90 toS120 is the same as the processing flow from Steps S40 to S70, thedescription of each step will be omitted. Upon completion of theregistration process of the authentication result in Step S120, theprocess proceeds to Step S130.

In Step S130, the event detection unit F22 determines whether the brakepedal has been stepped on by the user based on the vehicle informationacquired by the vehicle information acquisition unit F1. When it isdetected that the brake pedal is stepped on by the user, the affirmativedetermination is made in Step S130 and the process goes to Step S140.The negative determination is made in Step S130 until the brake pedal isstepped on by the user, and the determination process in Step S130 isexecuted at a predetermined time interval (for example, 100milliseconds). If the brake pedal has not been stepped on by the usereven after a lapse of a fixed time (for example, 10 minutes) sinceshifting to Step S130, the present flow may be ended.

Since the processing flow from Steps S140 to S170 is the same as theprocessing flow from Steps S40 to S70, the description of each step willbe omitted. Upon completion of the registration process of theauthentication result in Step S170, the process proceeds to Step S180.

In Step S180, the event detection unit F22 determines whether the startbutton 140 has been pushed down by the user based on the vehicleinformation acquired by the vehicle information acquisition unit F1.When it is detected that the start button 140 has been pushed down bythe user, the affirmative determination is made in Step S180 and theprocess goes to Step S190. The negative determination is made in StepS180 until the start button 140 is pushed down by the user, and thedetermination process in Step S180 is executed at a predetermined timeinterval (for example, 100 milliseconds). If the start button 140 hasnot been pushed down by the user even after a lapse of a fixed time (forexample, 5 minutes) since shifting to Step S180, the present flow may beended.

In Step S190, the authentication processing unit F4 determines whetherthe current operation mode is the alert mode. If the operation mode isthe alert mode, the affirmative determination is made in Step S190 andthe process proceeds to Step S200. On the other hand, if the operationmode is the alert cancellation mode, the negative determination is madein Step S190 and the process proceeds to Step S210. In Step S200, theauthentication processing unit F4 executes the same alert modeauthentication process as that in Step S10 and proceeds to Step S220. InStep S210, the authentication processing unit F4 executes thecancellation mode authentication process and proceeds to Step S220.

As a result of step S200 or S210, if the mobile device 200 has beensuccessfully authenticated, the affirmative determination is made inStep S220 and the process proceeds to Step S230. In Step S230, theengine is started in cooperation with the engine ECU 170 and the presentflow is ended. On the other hand, as a result of Step S200 or S210, ifthe authentication of the mobile device 200 has failed, the negativedetermination is made in Step S220 and the present flow is ended. Inother words, when the authentication fails, the engine is not started.

Overview of Present Embodiment

With the above configuration, the authentication process according tothe operation mode of the authentication ECU 110 is executed multipletimes during a series of operations to board the vehicle V in theparking state to the start of the engine. Then, if the alert modeauthentication process succeeds even once in the series ofauthentication processes, the authentication process using thenon-addition signal (that is, the cancellation mode authenticationprocess) is executed from the next time.

In other words, according to the configuration described above, as theauthentication process, the authentication process using the changeaddition signal is not necessarily performed every time. If the alertmode authentication process succeeds in the process of the userapproaching the parked vehicle V, the authentication process is executedwith the use of the non-addition signal in the subsequent processes. Forexample, when the user is seated in the driver's seat and presses thestart button, the cancellation mode authentication process is executed.

In the cancellation mode authentication process, since whether thestrength change occurs is irrelevant to the determination of whether themobile device 200 is to return the response signal even if the RSSI ofthe authentication signal is at the saturation level, the mobile device200 returns the response signal to the authentication signal.

By the way, since the RSSI decreases according to a signal propagationdistance, the case of receiving the authentication signal transmitted atthe suppression level from the in-vehicle system 100 at the saturationlevel is the case where the vehicle interior antenna 120A and the mobiledevice 200 are sufficiently close to each other as shown in FIG. 12. Itis assumed that the vehicle interior antenna 120A and the mobile device200 come close to each other as described above after the user is seatedin the driver's seat.

In view of the above, the possibility that the signal strength of theauthentication signal transmitted at the suppression level becomes thesaturation level is small in the process that the user approaches thevehicle V which is in the parking state or at the timing of opening orclosing the door for the driver's seat. For that reason, it can beexpected that the alert mode authentication process will succeed beforethe mobile device 200 is placed in the vicinity of the vehicle interiorantenna 120A.

Incidentally, an axis of ordinate in a graph shown in FIG. 12 representsRSSI, and an axis of abscissa represents a distance (hereinafter, adistance between the antennas) from the vehicle-side transmissionantenna 120 to the mobile device 200. A solid line represents thetransition of the RSSI of the signal transmitted at the default leveland an alternate long and short dashed line represents the transition ofthe RSSI of the signal transmitted at the suppression level.

Bupr shown on the vertical axis represents an upper limit value of anoutput range of the RSSI detection circuit 221 and Blwr represents alower limit value of the output range. A range from Blwr to Bupr is anoutput range of the RSSI detection circuit 221. D1 represents anantenna-to-antenna distance for receiving the authentication signaltransmitted at the suppression level at the saturation level. In otherwords, when the mobile device 200 is disposed within a range where adistance from the vehicle interior antenna 120A falls within a range D1,the strength change is not detected in the strength change region.

In the configuration of Patent Literature 1, when no change in strengthis observed in the authentication signal, the mobile device does notreturn the response signal. For that reason, when the mobile device 200is placed within a range where the distance from the vehicle interiorantenna 120A falls within D1 after the user boards the vehicle, theauthentication process may fail.

On the other hand, according to the configuration of the presentembodiment, there is a high possibility that the authentication processin the alert mode will succeed before the user is seated in the driver'sseat, and once the alert mode authentication process is successful, theauthentication process is performed with the use of the non-additionsignal. Therefore, according to the configuration described above, thepossibility that the mobile device 200 cannot be authenticated due tothe fact that the change in the strength of the authentication signalcannot be detected can be reduced.

Specifically, the possibility that the mobile device 200 will not beauthenticated due to the fact that the change in the strength of theauthentication signal cannot be detected, for example, when the startbutton 140 is pushed down can be reduced. Naturally, that a reduction inthe possibility that the mobile device 200 will not be authenticatedcorresponds to a reduction in the possibility of impairing the user'sconvenience.

When the vehicle is in the parking state, the mobile device 200determines whether the response signal is to be returned based onwhether the strength change occurs in the authentication signal. Forthat reason, as in Patent Literature 1, unauthorized authenticationsuccess due to the relay attack can be restricted. Therefore, accordingto the configuration described above, a reduction in the user'sconvenience can be restricted while the possibility that theauthentication in the wireless communication between the in-vehicledevice and the mobile device is illegally established is reduced.

The embodiments of the present disclosure have been described above.However, the present disclosure is not limited to the above-describedembodiments, and various modifications described below also fall withinthe technical scope of the present disclosure. Further, the presentdisclosure can be implemented with various changes without departingfrom the spirit of the present disclosure, aside from the followingmodifications.

The members having the same functions as those in the members describedin the above embodiment are denoted by the identical reference numerals,and a description of the same members will be omitted. Further, whenreferring to only a part of the configuration, the configuration of theembodiment described above can be applied to other portions.

Modification 1

In the above example, when the vehicle V is parked, the operation modeautomatically switches from the alert cancellation mode to the alertmode, but the present disclosure is not limited to the above example.For example, the user may operate a predetermined input device (in otherwords, manually) to shift from the alert cancellation mode to the alertmode.

In addition, in recent years, there is a vehicle security system thatcan park the vehicle in a state where a security level of the vehicle ishigher than that at the time of normal use (hereinafter referred to ashigh level) when the vehicle V is not used for a long trip or the like.In the vehicle equipped with such a vehicle security system, when thevehicle is parked with the security level set to the high level, theoperation mode may shift to the alert mode.

Modification 2

Further, in the example described above, the operation mode shifts tothe alert cancellation mode when the authentication process in the alertmode is successful, but the present disclosure is not limited to theabove example. For example, in a case where the door is opened or closedafter the authentication process in the alert mode is successful, theoperation mode may switch from the alert mode to the alert cancellationmode. Further, when the authentication process in the alert modesucceeds a predetermined number of times (for example, twice), the alertmode may shift to the alert cancellation mode.

While the disclosure has been described with reference to preferredembodiments thereof, it is to be understood that the disclosure is notlimited to the preferred embodiments and constructions. The disclosureis intended to cover various modification and equivalent arrangements.In addition, the various combinations and configurations, which arepreferred, other combinations and configurations, including more, lessor only a single element, are also within the spirit and scope of thedisclosure.

What is claimed is:
 1. A vehicular electronic key system comprising: anin-vehicle device that is mounted on a vehicle; and a mobile device thatis associated with the in-vehicle device and carried by a user of thevehicle, wherein the in-vehicle device performs a predetermined controlprocess to the vehicle when an authentication process by a wirelesscommunication between the in-vehicle device and the mobile device issuccessful, the in-vehicle device has two operation modes including analert mode and an alert cancellation mode, the in-vehicle device is setto execute the authentication process a plurality of times during aseries of operations supposed to be executed by the user when the userboards the vehicle that is parked and starts a power source of thevehicle, the in-vehicle device includes: a vehicle-side transmissionunit that transmits an authentication signal used for authentication ofthe mobile device from a vehicle-side transmission antenna provided inthe vehicle; a transmission strength adjustment unit that adjusts astrength of the authentication signal transmitted from the vehicle-sidetransmission antenna; and a mode control unit that controls theoperation mode of the in-vehicle device, the authentication signalincludes operation mode information indicating the operation mode of thein-vehicle device, when the in-vehicle device operates in the alertmode, the vehicle-side transmission unit transmits the authenticationsignal including a strength change signal that is a signal whose signalstrength is changed with a predetermined pattern, the mode control unitsets the operation mode to the alert mode when the vehicle is parked,and switches the operation mode to the alert cancellation mode if theauthentication of the mobile device is successful when the in-vehicledevice operates in the alert mode, the mobile device includes: a mobiledevice-side reception unit that receives the authentication signalthrough the mobile device-side reception antenna; a reception strengthdetection unit that sequentially detects a received signal strength ofthe signal received by the mobile device-side reception unit; a strengthchange determination unit that determines whether the strength changewith the predetermined pattern occurs in a strength change region thatis a portion corresponding to the strength change signal among theauthentication signals when receiving the authentication signalindicating that the in-vehicle device operates in the alert mode; and amobile device-side transmission unit that transmits a response signalthat is a signal as a response to the authentication signal, when themobile device-side reception unit receives the authentication signalindicating that the in-vehicle device operates in the alert cancellationmode, the mobile device-side transmission unit returns the responsesignal, and when the mobile device-side reception unit receives theauthentication signal indicating that the in-vehicle device operates inthe alert mode, the mobile device-side transmission unit returns theresponse signal if the strength change determination unit determinesthat the strength change occurs, and the mobile device-side transmissionunit does not return the response signal if the strength changedetermination unit determines that no strength change occurs in thestrength change region.
 2. The vehicular electronic key system accordingto claim 1, further comprising: a vehicle information acquisition unitthat acquires vehicle information as information indicating a state ofthe vehicle from a sensor mounted on the vehicle; and an event detectionunit that detects execution of a predetermined operation on the vehicleby the user as an occurrence of an authentication execution event forstarting the authentication process, based on the vehicle informationacquired by the vehicle information acquisition unit, wherein thevehicle-side transmission unit transmits the authentication signalaccording to the operation mode at the time when the occurrence of theauthentication execution event is detected by the event detection unit,and at least any two of an event that a door for a driver's seatprovided in the vehicle is opened, an event that the door for thedriver's seat is closed, an event that a brake pedal is stepped on, anevent that a parking brake is released, and an event that a start buttonfor instructing a start of the power source is pushed down areregistered as the authentication execution event.
 3. The vehicularelectronic key system according to claim 1, wherein the mode controlunit sets the operation mode to the alert mode when all of doorsprovided in the vehicle are locked.